BelT Block Cipher

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: We're looking at the paper: "BelT Block Cipher".

Elias: Here's the gist of the paper. The gist: BelT is a block cipher with a 128-bit block size and a 256-bit key developed in Belarus and adopted as part of the Belarusian national standard STB 34.101.31 for encryption and integrity control Specification The cipher employs an eight-round structure combining elements of a Feistel network and the Lai–Massey scheme The input data is processed using three 32-bit registers, initialized as a, b, c, d Encryption involves rounds 1 through 8, while decryption performs rounds 8 through 1 The ciphertext is defined as the block b∥d∥a∥c for encryption and the plaintext is c∥a∥d∥b for decryption Key Schedule and Transformation The key schedule generates round keys κi from a 256-bit key θ, where κi is the i-th element of the sequence θ1, θ2,..., θ8, θ1, theta2,..., theta8 For decryption, the round keys are generated using the sequence starting from θ8 down to θ1 The transformation Gr maps a 32-bit string u = u1∥ u2∥ u3∥ u4 to Gr(u) = λr(S(u1)S(u2)S(u3)S(u4)) The S-box S maps A8 to A8 and is specified in Table 1 Design Principles The design was guided by several main principles, including structural similarity of the encryption and decryption transformations, which simplifies software and hardware implementations Customization of the S-box S allows for a personalized cipher using a custom S-box as an additional long-term key The construction and properties of the S-box S were based on truth tables of coordinate Boolean functions selected as distinct length-255 segments of linear recurrence sequences with the primitive characteristic polynomial p(λ) = λ8 + λ6 + λ5 + λ2 + 1 Round Operations and Analysis During encryption round t, a sequence of operations is performed on the registers a, b, c, d and an auxiliary register e These steps include XOR operations with G functions like b ← b ⊕ G5(a ⊞ κ7t−6) and subsequent transformations such as a ← a ⊟ G13(b ⊞ κ7t−4) The transformation Gr is applied during the encryption process The alternation of operations, interleaving bitwise XOR with addition or subtraction modulo 232, makes certain cryptanalytic methods more difficult to apply Furthermore, non-uniform rounds are used where the contents of register e are combined with the round number ⟨t⟩32 in step (4) of each round Performance The performance analysis indicates that a 32-bit architecture was chosen as the basis for the cipher's design Software optimizations include precomputing expanded S-box tables for r = 5, 13, 21, 29 The calculation of G5(x), G13(x), and G21(x) is optimized by computing them as linear combinations of S-box outputs Benchmarking results show that the cipher achieves an encryption speed of 200 · 128 1367 ≈ 18.73 Mbit/s on a Pentium-200 CPU This performance was compared against candidates in the Advanced Encryption Standard (AES) competition, with BelT achieving a speed of 642 cycles on a Pentium II CPU The cipher also features a fast method for determining round keys κ1,..., κ56, which does not require any calculations in practical implementations Preliminary statistical analysis showed that significant statistical regularities are absent already for a 2-round construction, motivating the choice of eight rounds to establish a comfortable security margin The cipher's properties, such as nonlinearity of S being 102 and algebraic degree of every coordinate Boolean function being 7, provide resistance to linear cryptanalysis and higher-order differential attacks respectively The choice of eight rounds was motivated by the need to protect against common cryptanalytic methods and to establish a comfortable security margin The number of rounds was chosen because preliminary statistical analysis detected no significant statistical dependencies between plaintext, ciphertext, and key for a 2-round construction The cipher's design principles focus on structural similarity, customization of the S-box S, and specific construction properties of the S-box The performance comparison suggests BelT is competitive with other block ciphers in speed for a 32-bit architecture The cipher's structure and operational properties are designed to provide robust security against known cryptanalytic techniques The implementation details, including the use of expanded S-box tables, contribute to its efficiency in software execution The overall design aims to balance strong cryptographic properties with practical computational performance The cipher's structure and operational properties are designed to provide robust security against known cryptanalytic techniques Page 5 --- Some cryptographic properties of the resulting S-box are as follows 1) The nonlinearity of S is 102 (for the selected dimensions, the nonlinearity of S cannot exceed 120; high nonlinearity provides resistance to linear cryptanalysis

7: ) 2) The differential properties of S are characterized by the quantities R⊕⊕(S) = 8, R⊞⊞(S) = 7, R⊕⊞(S) = 6, R⊞⊕(S) = 3, where, for example, I

E: denotes the indicator function of the event E These values are sufficiently small to provide resistance to differential cryptanalysis

3: 5) The algebraic degree of every coordinate Boolean function of S is 7, which is the maximum possible value for the selected dimensions This hinders higher-order differential attacks

6: There are no quadratic relations connecting the inputs and outputs of the S-box Existence of such relations simplifies algebraic attacks

4: Page 6 --- 4.

Nadia: Alternation of operations As encryption/decryption algorithms are executed, the contents of the registers are combined with outputs of G using the operations ⊕, ⊞, and ⊟ Bitwise XOR is interleaved with addition or subtraction modulo 232 The use of operations from different algebraic groups and their alternation makes certain cryptanalytic methods more difficult to apply Page 4 --- Table 4: Pentium-family CPU cycles required to encrypt 16 bytes of plaintext The table shows that the cipher achieves an encryption speed of 200 · 128 1367 ≈ 18.

Paper summary: Nadia: So we've looked at the BelT Block Cipher paper, and now we’re getting to the wrap-up about what this actually means for security.

Elias: Yeah, the authors are showing how they built this cipher from scratch in Belarus, using a specific structure that combines Feistel and Lai–Massey ideas <ref:2610.31178#pg1>.

Priya: So when you look at the final conclusion, what’s the main point they're trying to make about this design?

Nadia: They emphasize that by choosing eight rounds instead of just two, they established a solid security margin against common cryptanalytic methods <ref:2610.31178#pg1>.

Elias: That makes sense because their preliminary statistical analysis showed no significant regularities even in a two-round version, which is what motivated them to go for that extra mixing <ref:2610.31178#pg1>.

Priya: So this means the design isn't just randomly mixed; it has some specific mathematical properties they've tuned in there.

Nadia: Exactly, and they pointed out that the S-box nonlinearity is one hundred two and the algebraic degree of every function is seven, which helps resist linear cryptanalysis and higher-order differential attacks <ref:2610.31178#pg3>.

Elias: That level of resistance against those specific attack types is what sets it apart for someone thinking about long-term security parameters <ref:2610.31178#pg1>.

Priya: For someone just listening to the show, what does that actually translate to in terms of real-world protection?

Nadia: It means they’ve tried to balance very strong mathematical properties with making sure the cipher runs efficiently on a thirty-two-bit architecture <ref:2610.31178#pg2>.

Elias: And they did show performance tests comparing it against AES candidates, suggesting it's competitive in speed for that kind of hardware <ref:2610.31178#pg4>.

Priya: So, what's the big picture here for people who are trying to build secure systems?

Nadia: It shows that you can take specific mathematical constraints, like those from linear recurrence sequences, and use them to design a cipher with a balanced structure <ref:2610.31178#pg1>.

Elias: The implication is that this approach—custom S-boxes based on those sequences—is a viable way to explore new cipher designs without relying on the same old structures <ref:2610.31178#pg1>.

Priya: What's next for this research? Are they looking at how practical implementations handle those complex round operations?

Nadia: They are moving toward discussing software performance and possible optimizations, which is where we look next because that’s how we figure out if it’s actually usable in a real system <ref:2610.31178#pg2>.

Conclusion: Nadia: So, to wrap up this talk on BelT Block Cipher, we’ve looked at how they built this cipher from scratch in Belarus and what those specific mathematical choices mean for its security level.

Elias: Yeah, they developed it using a combination of a Feistel network structure and the Lai–Massey scheme as their core design approach.

Priya: So when you think about the final conclusion, what’s the main point they're making about this whole BelT thing?

Nadia: They emphasize that by choosing eight rounds instead of just two, they built in a solid security margin against common attack methods.

Elias: That makes sense because their initial statistical checks showed no significant patterns even in a two-round version, which drove them to add that extra mixing.

Priya: This tells us the design isn't just random; it has specific mathematical tuning built into it for defense.

Nadia: Exactly, they pointed out the S-box nonlinearity is one hundred two and the algebraic degree of every function is seven, which helps them resist linear cryptanalysis and higher-order differential attacks.

Elias: That level of resistance against those specific attack types is what matters when you think about long-term security parameters for a cipher.

Priya: For someone listening who isn't doing deep cryptanalysis, what does that actually translate to in terms of real-world protection?

Nadia: It means they balanced these strong mathematical properties with making sure the cipher runs efficiently on a thirty-two-bit architecture.

Elias: And they showed performance tests comparing it against candidates in the Advanced Encryption Standard competition, suggesting it’s competitive in speed for that kind of hardware.

Priya: So, what's the big picture here for people trying to build secure systems?

Nadia: It shows you can take specific mathematical constraints from linear recurrence sequences and use them to design a cipher with a balanced structure.

Elias: The implication is that this approach—custom S-boxes based on those sequences—is a viable way to explore new cipher designs without relying on the same old structures.

Priya: What’s next for this research? Are they looking at how practical implementations handle those complex round operations?

Nadia: They are moving toward discussing software performance and possible optimizations, which is where we look next because that’s how we figure out if it’s actually usable in a real system.